The obvious choice is to generate seeds offline by picking words out of a thoroughly mixed Entropia set, computing the checksum with an airgapped seedsigner (inside a back seat faraday cage of course), then load this seed into a coldcard, apply long passphrase, incinerate the closed firmware seedsigner before exiting the vehicle, visit unchained.com from a single use Linux laptop, and setup vault key #1.

Repeat x2 for optimal multi vendor unchained setup without funding shitcoining wallet companies.

This is the synthesis of everything I learned listening to Bitcoin Review Pod over the last year. ♥️💪🏼